Virtual network analysis and exploitation

ABSTRACT

Methods and systems that evaluate currently operating online personas is automated to establish the relationships between nodes and assign attributes. A virtual network exploitation (ViNE) protocol can create a prioritized list of every account in the extended network based on its influence score, as well as filtering, to create a subset of the influencer list of accounts that meet attribute criteria. Analysis of this data can identify the key accounts for the influencer and lead lists and provide recommendations on the path and strategy the client should use to most effectively engage the accounts of interest. Automated seed list generation for SNA can be operationalized to identify all of the existing leads within an extended social network in priority order and provide an influence score for each account. The system can be scaled to combine individual accounts that focus on a specific organization, personality or region.

BACKGROUND OF THE INVENTION 1. Field of the Invention

Embodiments of the invention relate generally to systems and methods forvirtual network analysis and exploitation. More particularly,embodiments of the invention relate to an automated system and method tocreate seed data for Social Network Analysis (SNA) of virtual networksand apply the SNA results to identify leads and influencers within theextended network in priority order.

2. Description of Prior Art and Related Information

The following background information may present examples of specificaspects of the prior art (e.g., without limitation, approaches, facts,or common wisdom) that, while expected to be helpful to further educatethe reader as to additional aspects of the prior art, is not to beconstrued as limiting the present invention, or any embodiments thereof,to anything stated or implied therein or inferred thereupon.

SNA involves a process of investigating social structures through theuse of networks and graph theory. Networked structures include nodes(individual actors within the network) and edges (relationships orinteractions) connecting nodes. Examples of social structures commonlyvisualized through social network analysis include social medianetworks, memes spread, information circulation, friendship andacquaintance networks, business networks, knowledge networks and thelike. These visualizations provide a means of qualitatively assessingnetworks by varying the visual representation of their nodes and edgesto reflect attributes of interest.

Virtual personas, however, were unable to identify accounts that mettheir target audience criteria or key influencers within their personalnetwork on various social media platforms.

In view of the foregoing, there is a need for automated systems andmethods for creating seed data for SNA of virtual networks and apply theSNA results to identify leads and influencers within the extendednetwork in priority order.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide a method of automaticallyidentifying lead and influencer accounts in an extended network of anonline persona comprising determining friends of the online persona andfriends of the friends of the online persona; creating an edges list,from the raw data (aka “combined csv”) file, as an edges file (alsoreferred to as a raw data file) including a plurality of separateentries as separate rows in a spreadsheet, each of the separate entriesincluding a first identification information concerning a specificfriend of the online persona and a second identification informationconcerning a specific friend of the specific friend of the onlinepersona; creating a nodes list as a node file, the node file being aduplicate of the raw data file, with duplicate ones of the plurality ofseparate entries removed, with the remaining columns C and D entriesappended to columns A and B, and having a status identifier column inthe spreadsheet added for each of the plurality of separate entries;establishing an op-update dictionary containing one or more personas ofinterest; comparing each of the plurality of separate entries in thenode file with data in the op-update dictionary to find matchingpersonas of interest from the op-update dictionary; creating a personadictionary containing one or more controlled personas; comparing each ofthe plurality of separate entries in the node file with data in thepersona dictionary to find matching controlled personas from the personadictionary; adding the matching personas of interest and matchingcontrolled personas into the status identifier for the one of theplurality of separate entries in the node file; and applying socialnetwork analysis metrics to the node file and the edges file to identifythe lead and influencer accounts in the extended network.

Embodiments of the present invention further provide a method forautomatically identifying accounts of interest in a virtual network, andsoftware modules programmed for achieving the same, comprisingdetermining friends of a subject; determining friends of the friends ofthe subject; creating an edges list as an edges file including aplurality of separate entries, each of the separate entries including afirst identification information concerning a specific friend of thesubject and a second identification information concerning a specificfriend of the specific friend of the subject; creating a nodes list as anode file, the node file being a duplicate of the raw data file, withduplicate ones of the plurality of separate entries removed, with theremaining columns C and D entries appended to columns A and B, andhaving a status identifier added for each of the plurality of separateentries; establishing an op-update dictionary containing one or morepersonas of interest; comparing each of the plurality of separateentries in the node file with data in the op-update dictionary to findmatching personas of interest from the op-update dictionary; adding thematching personas of interest into the status identifier for the one ofthe plurality of separate entries in the node file; and applying socialnetwork analysis metrics, including a custom metric that is specific tothe present invention, to the node file and the edges file to identifythe accounts of interest.

These and other features, aspects and advantages of the presentinvention will become better understood with reference to the followingdrawings, description and claims.

BRIEF DESCRIPTION OF THE DRAWINGS

Some embodiments of the present invention are illustrated as an exampleand are not limited by the figures of the accompanying drawings, inwhich like references may indicate similar elements.

FIG. 1 illustrates a high-level block diagram describing a methodaccording to an exemplary embodiment of the present invention;

FIG. 2 illustrates a detailed block diagram describing steps associatedwith creating seed lists and enable SNA, according to an exemplaryembodiment of the present invention;

FIG. 3 illustrates a detailed block diagram describing steps associatedwith creating an edges list, according to an exemplary embodiment of thepresent invention;

FIG. 4 illustrates a detailed block diagram describing steps associatedwith creating a nodes list, according to an exemplary embodiment of thepresent invention;

FIG. 5 illustrates a detailed block diagram describing steps associatedwith running SNA and visualization programs, according to an exemplaryembodiment of the present invention;

FIG. 6 illustrates an exemplary SNA graph generated by embodiments ofthe present invention; and

FIG. 7 illustrates a functional block diagram illustration of a computerhardware platform that can be used to implement a virtual networkanalysis and exploitation system, consistent with an illustrativeembodiment of the present invention.

Unless otherwise indicated illustrations in the figures are notnecessarily drawn to scale.

The invention and its various embodiments can now be better understoodby turning to the following detailed description wherein illustratedembodiments are described. It is to be expressly understood that theillustrated embodiments are set forth as examples and not by way oflimitations on the invention as ultimately defined in the claims.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS AND BEST MODE OFINVENTION

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the term “and/or” includes any and all combinations of oneor more of the associated listed items. As used herein, the singularforms “a,” “an,” and “the” are intended to include the plural forms aswell as the singular forms, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, steps, operations, elements, and/orcomponents, but do not preclude the presence or addition of one or moreother features, steps, operations, elements, components, and/or groupsthereof.

Unless otherwise defined, all terms (including technical and scientificterms) used herein have the same meaning as commonly understood by onehaving ordinary skill in the art to which this invention belongs. Itwill be further understood that terms, such as those defined in commonlyused dictionaries, should be interpreted as having a meaning that isconsistent with their meaning in the context of the relevant art and thepresent disclosure and will not be interpreted in an idealized or overlyformal sense unless expressly so defined herein.

In describing the invention, it will be understood that a number oftechniques and steps are disclosed. Each of these has individual benefitand each can also be used in conjunction with one or more, or in somecases all, of the other disclosed techniques. Accordingly, for the sakeof clarity, this description will refrain from repeating every possiblecombination of the individual steps in an unnecessary fashion.Nevertheless, the specification and claims should be read with theunderstanding that such combinations are entirely within the scope ofthe invention and the claims.

In the following description, for purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the present invention. It will be evident, however, toone skilled in the art that the present invention may be practicedwithout these specific details.

The present disclosure is to be considered as an exemplification of theinvention and is not intended to limit the invention to the specificembodiments illustrated by the figures or description below.

As is well known to those skilled in the art, many carefulconsiderations and compromises typically must be made when designing forthe optimal configuration of a commercial implementation of any system,and in particular, the embodiments of the present invention. Acommercial implementation in accordance with the spirit and teachings ofthe present invention may be configured according to the needs of theparticular application, whereby any aspect(s), feature(s), function(s),result(s), component(s), approach(es), or step(s) of the teachingsrelated to any described embodiment of the present invention may besuitably omitted, included, adapted, mixed and matched, or improvedand/or optimized by those skilled in the art, using their average skillsand known techniques, to achieve the desired implementation thataddresses the needs of the particular application.

A “computer” or “computing device” may refer to one or more apparatusand/or one or more systems that are capable of accepting a structuredinput, processing the structured input according to prescribed rules,and producing results of the processing as output. Examples of acomputer or computing device may include: a computer; a stationaryand/or portable computer; a computer having a single processor, multipleprocessors, or multi-core processors, which may operate in paralleland/or not in parallel; computer; a supercomputer; a mainframe; a supermini-computer; a mini-computer; a workstation; a micro-computer; aserver; a client; an interactive television; a web appliance; atelecommunications device with internet access; a hybrid combination ofa computer and an interactive television; a portable computer; a tabletpersonal computer (PC); a personal digital assistant (PDA); a portabletelephone; application-specific hardware to emulate a computer and/orsoftware, such as, for example, a digital signal processor (DSP), afield programmable gate array (FPGA), an application specific integratedcircuit (ASIC), an application specific instruction-set processor(ASIP), a chip, chips, a system on a chip, or a chip set; a dataacquisition device; an optical computer; a quantum computer; abiological computer; and generally, an apparatus that may accept data,process data according to one or more stored software programs, generateresults, and typically include input, output, storage, arithmetic,logic, and control units.

“Software” or “application” may refer to prescribed rules to operate acomputer. Examples of software or applications may include: codesegments in one or more computer-readable languages; graphical andor/textual instructions; applets; pre-compiled code; interpreted code;compiled code; and computer programs.

The example embodiments described herein can be implemented in anoperating environment comprising computer-executable instructions (e.g.,software) installed on a computer, in hardware, or in a combination ofsoftware and hardware. The computer-executable instructions can bewritten in a computer programming language or can be embodied infirmware logic. If written in a programming language conforming to arecognized standard, such instructions can be executed on a variety ofhardware platforms and for interfaces to a variety of operating systems.Although not limited thereto, computer software program code forcarrying out operations for aspects of the present invention can bewritten in any combination of one or more suitable programminglanguages, including an object-oriented programming languages and/orconventional procedural programming languages, and/or programminglanguages such as, for example, Hypertext Markup Language (HTML),Dynamic HTML, Extensible Markup Language (XML), Extensible StylesheetLanguage (XSL), Document Style Semantics and Specification Language(DSSSL), Cascading Style Sheets (CSS), Synchronized MultimediaIntegration Language (SMIL), Wireless Markup Language (WML), Java®,Jini®, C, C++, Smalltalk, Python, Perl, UNIX Shell, Visual Basic orVisual Basic Script, Virtual Reality Markup Language (VRML), ColdFusion®or other compilers, assemblers, interpreters or other computer languagesor platforms.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object-oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider). The program code may also be distributed among a plurality ofcomputational units wherein each unit processes a portion of the totalcomputation.

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

Further, although process steps, method steps, algorithms or the likemay be described in a sequential order, such processes, methods andalgorithms may be configured to work in alternate orders. In otherwords, any sequence or order of steps that may be described does notnecessarily indicate a requirement that the steps be performed in thatorder. The steps of processes described herein may be performed in anyorder practical. Further, some steps may be performed simultaneously.

It will be readily apparent that the various methods and algorithmsdescribed herein may be implemented by, e.g., appropriately programmedcomputers and computing devices. Typically, a processor (e.g., amicroprocessor) will receive instructions from a memory or like device,and execute those instructions, thereby performing a process defined bythose instructions. Further, programs that implement such methods andalgorithms may be stored and transmitted using a variety of known media.

When a single device or article is described herein, it will be readilyapparent that more than one device/article (whether or not theycooperate) may be used in place of a single device/article. Similarly,where more than one device or article is described herein (whether ornot they cooperate), it will be readily apparent that a singledevice/article may be used in place of the more than one device orarticle.

The term “computer-readable medium” as used herein refers to any mediumthat participates in providing data (e.g., instructions) which may beread by a computer, a processor or a like device. Such a medium may takemany forms, including but not limited to, non-volatile media, volatilemedia, and transmission media. Non-volatile media include, for example,optical or magnetic disks and other persistent memory. Volatile mediainclude dynamic random access memory (DRAM), which typically constitutesthe main memory. Transmission media include coaxial cables, copper wireand fiber optics, including the wires that comprise a system bus coupledto the processor. Transmission media may include or convey acousticwaves, light waves and electromagnetic emissions, such as thosegenerated during radio frequency (RF) and infrared (IR) datacommunications. Common forms of computer-readable media include, forexample, a floppy disk, a flexible disk, hard disk, magnetic tape, anyother magnetic medium, a CD-ROM, DVD, any other optical medium, punchcards, paper tape, any other physical medium with patterns of holes, aRAM, a PROM, an EPROM, a FLASHEEPROM, any other memory chip orcartridge, a carrier wave as described hereinafter, or any other mediumfrom which a computer can read.

Various forms of computer readable media may be involved in carryingsequences of instructions to a processor. For example, sequences ofinstruction (i) may be delivered from RAM to a processor, (ii) may becarried over a wireless transmission medium, and/or (iii) may beformatted according to numerous formats, standards or protocols, such asBluetooth, TDMA, CDMA, 3G, 4G, 5G and the like.

Where databases are described, it will be understood by one of ordinaryskill in the art that (i) alternative database structures to thosedescribed may be readily employed, (ii) other memory structures besidesdatabases may be readily employed. Any schematic illustrations andaccompanying descriptions of any sample databases presented herein areexemplary arrangements for stored representations of information. Anynumber of other arrangements may be employed besides those suggested bythe tables shown. Similarly, any illustrated entries of the databasesrepresent exemplary information only; those skilled in the art willunderstand that the number and content of the entries can be differentfrom those illustrated herein. Further, despite any depiction of thedatabases as tables, an object-based model could be used to store andmanipulate the data types of the present invention and likewise, objectmethods or behaviors can be used to implement the processes of thepresent invention.

Broadly, embodiments of the present invention provide methods and systemfor the evaluation of currently operating online personas that isautomated to establish the relationships between nodes and assignattributes. A virtual network exploitation (ViNE) protocol can create aprioritized list of every account in the extended network (a two-stepSNA) based on its “influence” score as well as filtering to create asubset of the influencer list of accounts that meet the attributecriteria. Analysis of this data can identify the key accounts for theinfluencer and lead lists and provide recommendations on the path andstrategy the client should use to most effectively engage the accountsof interest.

Aspects of the present invention provide methods to automate seed listgeneration for SNA that can be operationalized to identify all of theexisting leads within an extended social network, such as friends of thepersona and the friends' friends, for example, in priority order andprovide an influence score for each account, which can be provided inpriority order. The client can provide strategic and tactical directionfor its online personas. The system can also be scaled to combineindividual accounts that focus on a specific organization, personalityor region to expand the options for engaging leads ordeconflicting/coordinating efforts against selective leads/accounts.

As used herein, the term “friends” of a subject persona refers to onlinepersonas that are connected to the subject persona. “Friends” may bedefined differently on different platforms, including terms such asbuddies, connections, links, followers, contacts, or the like.Typically, “friends” are links that the subject persona makes orapproves on the selected network. The subject persona can have a firstplurality of friends. These are personas that are directly linked to thesubject persona. The term “friends of friends” refers to a secondplurality of friends that are “friends” of this first plurality offriends. The subject persona “A” can have friends “B” and C″, while “B”can have friends “D” and “E” and “C” can have friends “F” and “G”. Thus,the “friends of friends” of the subject persona “A” are “D”, “E”, “F”and “G”.

As used herein, the term “persona” can refer to an online account on aspecific online platform. Such an online account of a “persona” canbelong to an individual, a group, a community, an organization, agovernment or the like. A “persona” may be any account that may beregistered on an online platform.

As discussed in greater detail below, aspects of the presentinvention 1) build out an extended social network of a specificaccount/website to expand the reach and resonance of the account; 2)identify all of the accounts that meet the customer's lead criteria inpriority order; 3) identify key influencers within the extended networkin priority order (and highlight accounts with low influence to beavoided); and 4) create strategies to exploit the accounts of interest.

Referring to FIGS. 1 and 2 , according to aspects of the presentinvention, a first act 100 can create the seed lists to enable the SNA.This act can include a first sub-act 102 of receiving the details of thepersona/account/website that will be the subject of the project. This istypically provided by the customer, which can be an individual, company,government, or the like. In some embodiments, a sub-act 104 can receivedetails of personas “of interest” from the customer. Next, in sub-act106, the system can obtain the list of friends of the persona ofinterest and further obtain the list of the friend's friends of thepersona of interest. This can be provided, for example, by a web crawlerservice. This information can be provided as a single file for eachfriend. Each list can contain as many as 5,000 entries, for example. Insome embodiments, the files can be provided in a spreadsheet format(such as a .csv file) that contains four columns, where column A is thefriend's social media ID, which is a unique number on the social mediaplatform; column B is the username or display name; column C is thefriend's friend's platform ID and column D is friend's friend's user ordisplay name. The final edges list (that is, a list of the connectionsbetween the persona of interest, friends of the persona of interest, andthe friend's friends of the persona of interest) may include a combinedtotal of as many as 25 million row entries. In conventional processesfor SNA, similar steps were completed manually and was prone to theintroduction of errors that can cause downstream errors.

At the same time, in sub-set 108, a parent directory for the project iscreated using, for example, the persona's name and a child(subdirectory) can be created that will later house the friend listsfrom the web crawler.

Referring now to FIGS. 1 and 3 , an act 110 can create an edge list.Software modules can be programmed, for example, in Python, generate theseed lists, where two lists are generated, an edges list and a nodeslist, as discussed in greater detail below. In some embodiments, theedges list can be generated first and then the nodes list can be createdfrom the output file from the edges script, since the nodes list buildsoff of a subset of the edges list.

At sub-act 112, an “EdgeListGenerator” program can be used to combineall of the friends lists into one correctly formatted master list, whichcan populate into the same directory as the individual friends lists andcan be called, for example, “combined_csv”. The script contains modules,at sub-act 114, that correctly formats each entry (per act 100) andautomatically fills every empty cell in the spreadsheet in column A with“NoName” if an entry name is missing and a coded entry (such as NINCs(Hungarian for “none”)) in columns B or C. The script can import and usethe following Python packages: OS, glob, Pandas, Openpyxl and pprint bymeans of a Pandas data frame with parameters that account for mostEuropean languages; the parameter can be modified to accommodate anyworld language that has been previously used in programming.

Referring now to FIGS. 1 and 4 , an act 120 can create a nodes list. Thenodes list is a compilation of each unique entry in the edges listoutput file. Using the combined_csv file for the project as the basis,the method can include 1) a first sub-act 122 that can rename and savethe file as the nodeslist for the project using the convention, forexample, “nodelist.persona name.final” in the parent directory for theproject; 2) a second sub-act 124 that can use the built-in macro in thespreadsheet software to delete duplicates for columns A/B and C/D, thensave the file; 3) a third sub-act 126 that can use the append functionto move data (without the duplicates) from columns C/D to columns A/B;4) a sub-act 128 that can add new headers for column C (called Status,for example) and column D (called Notes, for example); and 5) a sub-act129 that can run a NodesListGenerator script.

This script can import the Python package, “openpyxl”, can create a newspreadsheet workbook and can compare each entry against thecustomer-provided “of interest” or market intelligence data which can beconverted into a Python dictionary named “ops_updates”, for example,with the key being the user or display name of the account of interestand the value being “ops” or whatever term the customer prefers. Asecond dictionary can be created named, for example, “persona updates”that can contain the unique ID of other accounts that the customercontrols. The ops_updates dictionary can identify accounts that areleads for the persona, while the persona_updates dictionary can identifyother accounts that the customer operates that could be used todeconflict the other personas' activity or provide an opportunity forthese overlapping personas to cooperate against the accounts that theyhave in common.

The program can operate, for example, by using an embedded “for loops”and “if” statements that check each entry in both dictionaries againstthe contents of the nodes list. For each entry that appears in one ofthe dictionaries, a correct entry is added to the “status” column in thespreadsheet. The “notes” column is a free-form field that allows thecustomer to provide a status update regarding engagement of the accountin question once the ViNE Protocol is complete and handed over.Follow-up iterative analyses can be run to update the results over timeand provide follow-on guidance and recommendations. The output file willbe named, for example, using the convention, “updatedpersonanameNodes”.

Referring now to FIGS. 1 and 5 , in an act 130, the SNA andvisualization Python program can be run using the newly created edge andnodes lists and a ViNE_Ex_GephiMstr script. This program can import anduse the following Python modules: csv, itemgetter, networkx, community(from networks.algorithms) and pprint. The program can, at sub-act 132,read the edge and node lists that were created in acts 110 and 120,respectively, can, at sub-act 134, report how many edges and nodes arecontained in the network (called a graph in Python network nomenclature)and can, at sub-act 136, create a visualization of the data using theGephi visualization software. Such a visualization is exemplified inFIG. 6 . The network Python module contains utilities that segment thedata from the SNA to generate centrality metrics that can focus onindividual accounts of interest. The typical SNA metrics that aregenerated are (1) Betweenness (which account(s) connect the mostgroups/communities of other accounts), (2) Closeness (which is a measureof how near the subject account is to other accounts), (3) Eigenvector(which accounts are directly connected to the most accounts in theextended network), and (4) Degree (how many steps the account is fromother accounts in its community). In addition to the standard SNAmetrics, the system and methods of the present invention can calculateand use the combined Eigenvector and Betweenness (BE) score to assessinfluence and target priorities, because it does a better job ofidentifying the all-around most important accounts in the network. Thesemodules can be used to provide detailed analysis of the connectionsbetween important nodes (individual accounts) as well as keyinfluencers. The analysis is free form and depends on the needs of theclient and the quality of the data.

Referring back to FIG. 1 , in act 140, a report can be generated. Theinsights from the analysis can be gathered into a report that isprovided to the client. In an exemplary embodiment, a first report is a“baseline” that can be used as the jumping off point to conductfollow-on ViNE Protocol analyses.

In some embodiments, an external network report, including SNA resultsand operational recommendations, can be generated based on the SNA dataand the client's market intelligence. In some embodiments, an internaltradecraft report can be generated. An exemplary tradecraft report isdiscussed below with respect to FIG. 6 .

Referring now to FIG. 6 , in an exemplary project, the subject personahad only 10 connected accounts. Using aspects of the present invention,a total of 353 connections were identified, the influence score of everyaccount in the extended network was identified, which accounts were ofgreatest importance, in terms of reach and resonance, were identifiedwhere none existed before, and every account that the client considereda lead was identified where none had been identified previously. Theprocess, according to embodiments of the present invention, is muchfaster than conventional processes, creating the predicate seed lists inapproximately 30 seconds versus 3 days when the sample list was createdmanually at the beginning of the development process for the presentinvention. Aspects of the present invention can identify the path thatthe subject persona should pursue for each of its most important leads.

In the Example of FIG. 6 , from the persona of interest's (Jack Bauer)10 friends with no known targets, the SNA identified 353 total nodes,providing expanded reach; and 30 targets identified that were previouslyunknown to be in the network. Operational paths from the persona ofinterest to each target is identified, where top influencers equate togreater resonance.

A sample external report for the example of FIG. 6 can describe, basedon the Social Network Analysis (SNA), the persona, Jack Bauer, is the10th most influential account in the extended network. There are 32previously unidentified targets in the extended network. The SNA metricsidentified these accounts as the top 5 targets (in priority order):Martha Smith, Vizsga Mir, Tiet Li, Baba Yaga and Sun Wu-kong.

The report may include op paths to Martha Smith, which can includeMitchell Forbes (0.099)—>Martha Smith, Russell Arnow (0.113)—>MarthaSmith, Otto Autrey (0.312)—>Martha Smith and Maya Pope (0.104)—>MarthaSmith. In this example, none of the paths contain a target. In thiscase, the system can recommend pursuing the path with the highestcombined Eigenvector and Betweenness (BE) score (Otto Autrey), vice theSNA recommendation (Maya Pope).

The report may include targets associated with Martha Smith, ordered bypriority, as well as the top five influencers of the network. Theseaccounts can be used for reach and resonance of influence messaging oras part of an operational approach.

An exemplary tradecraft report can include an operational overview,which can state, for example, “During the most recent six-monthreporting period (July-December 2021), the Jack Bauer persona (ID 351)engaged 10 identified high priority accounts. These efforts resulted inestablishment of 2 information providing relationships, 1 handoff tocooperating persona and 3 operations that led to the arrest of terrorcell members who were actively planning attacks against US interests.The average number of engagements per day was 7.2 with 1,080 totalengagements of confirmed target audience accounts.” The report can alsoinclude specific tradecraft of the persona, such as “Persona'sengagements demonstrated high quality tradecraft including: Use ofembedded hashtags on Twitter posts; Cross referencing of accounts thatthe target audience typically consumes; and Use of higher frequencyaccounts on more popular platforms to drive readership to emergingplatforms and alternate client-operated accounts.” The report canfurther include recommendations, such as “Data from across the area ofresponsibility (AOR) indicates that the target audience is moving toincreased use of Telegram in lieu of Tutanota; recommend that personacreate a Tutanota account in anticipation of a near term need to engagethe target audience.” Of course, the above is one example of variousaspects of reports available with the system and methods of the presentinvention.

With the prior solution, the creation of the combined raw data seed list(the combined_csv file) was done manually and depending on the number ofnodes in the network, could take 5-7 full work days versus 30 secondswith the methods and systems of the present invention. The cost savingsof automated vs manual seed list creation saves $300/man hour perpersona in contracting costs. Further, the cost to acquire raw datadrops dramatically, where the previous solution relied on an outsidefirm with huge infrastructure and personnel (dozens of full-time onsitecontractors) costs to provide the feed data for the seed lists. Thesolution provided by aspects of the present invention does this at asmall fraction of the cost. Further, with the system and methods of thepresent invention, completeness is improved, since the previous solutiondiscarded entries with missing information, where the present inventionretains these entries (which may contain leads or key influencers).Finally, with the system and methods of the present invention, accuracyis improved. The previous solution relied on Humans to identify and weedout redundancies, errors and omissions, which can result in errors inthe data. The system and methods of the present invention can avoid suchissues with its automated approach.

For some personas of interest, as discussed above, the edges file caninclude millions or tens of millions of rows of data. Such compilationand analysis of data would be virtually impossible to achieve withoutthe systems and methods of the present invention.

FIG. 7 provides a functional block diagram illustration of a computerhardware platform 170 that can be used to implement a particularlyconfigured computing device that can host a virtual network analysis andexploitation system 172. The system 172 can include an edges listcreation module 174, including program code to provide the functionalitydiscussed above with respect to FIGS. 1 and 3 ; a nodes list creationmodule 176, including program code to provide the functionalitydiscussed above with respect to FIGS. 1 and 4 ; and a SNA andvisualization module 178, including program code to provide thefunctionality discussed above with respect to FIGS. 1 and 5 .

The computer platform 170 may include a central processing unit (CPU)180, a hard disk drive (HDD) 182, random access memory (RAM) and/or readonly memory (ROM) 184, a keyboard 186, a mouse 188, a display 190, and acommunication interface 192, which are connected to a system bus 194. Ofcourse, other configurations for an exemplary computer platform 170 maybe used to implement aspects of the present invention.

In one embodiment, the HDD 182, has capabilities that include storing aprogram that can execute various processes, such as the virtual networkanalysis and exploitation system 172, in a manner described herein.

All the features disclosed in this specification, including anyaccompanying abstract and drawings, may be replaced by alternativefeatures serving the same, equivalent or similar purpose, unlessexpressly stated otherwise. Thus, unless expressly stated otherwise,each feature disclosed is one example only of a generic series ofequivalent or similar features.

Claim elements and steps herein may have been numbered and/or letteredsolely as an aid in readability and understanding. Any such numberingand lettering in itself is not intended to and should not be taken toindicate the ordering of elements and/or steps in the claims.

Many alterations and modifications may be made by those having ordinaryskill in the art without departing from the spirit and scope of theinvention. Therefore, it must be understood that the illustratedembodiments have been set forth only for the purposes of examples andthat they should not be taken as limiting the invention as defined bythe following claims. For example, notwithstanding the fact that theelements of a claim are set forth below in a certain combination, itmust be expressly understood that the invention includes othercombinations of fewer, more or different ones of the disclosed elements.

The words used in this specification to describe the invention and itsvarious embodiments are to be understood not only in the sense of theircommonly defined meanings, but to include by special definition in thisspecification the generic structure, material or acts of which theyrepresent a single species.

The definitions of the words or elements of the following claims are,therefore, defined in this specification to not only include thecombination of elements which are literally set forth. In this sense itis therefore contemplated that an equivalent substitution of two or moreelements may be made for any one of the elements in the claims below orthat a single element may be substituted for two or more elements in aclaim. Although elements may be described above as acting in certaincombinations and even initially claimed as such, it is to be expresslyunderstood that one or more elements from a claimed combination can insome cases be excised from the combination and that the claimedcombination may be directed to a subcombination or variation of asubcombination.

Insubstantial changes from the claimed subject matter as viewed by aperson with ordinary skill in the art, now known or later devised, areexpressly contemplated as being equivalently within the scope of theclaims. Therefore, obvious substitutions now or later known to one withordinary skill in the art are defined to be within the scope of thedefined elements.

The claims are thus to be understood to include what is specificallyillustrated and described above, what is conceptually equivalent, whatcan be obviously substituted and also what incorporates the essentialidea of the invention.

What is claimed is:
 1. A method for automatically identifying accountsof interest in a virtual network, comprising: determining friends of asubject; determining friends of the friends of the subject; creating anedges list as a raw data file including a plurality of separate entries,each of the separate entries including a first identificationinformation concerning a specific friend of the subject and a secondidentification information concerning a specific friend of the specificfriend of the subject; creating a separate file, a nodes list, as a nodefile, the node file initially being a duplicate of the raw data file,with duplicate ones of the plurality of separate entries removed and astatus identifier field added for each resulting entry; establishing anop-update dictionary containing one or more personas of interest;comparing each of the plurality of separate entries in the node filewith data in the op-update dictionary to find matching personas ofinterest from the op-update dictionary; adding the matching personas ofinterest into the status identifier field for the one of the pluralityof separate entries in the node file; and applying social networkanalysis metrics to the node file and the raw data file to identify theaccounts of interest.
 2. The method of claim 1, further comprising:creating a persona dictionary containing one or more personas controlledby the subject; comparing each of the plurality of separate entries inthe node file with data in the persona dictionary to find matchingcontrolled personas from the persona dictionary; adding the matchingcontrolled personas into the status identifier for the one of theplurality of separate entries in the node file.
 3. The method of claim1, wherein the one or more personas of interest in the op-updatedictionary are provided by one of the subject or by market intelligencedata.
 4. The method of claim 1, wherein the raw data file and node fileare spreadsheet files and each of the plurality of separate entries arerows in the spreadsheet files.
 5. The method of claim 4, wherein: thefirst identification information includes (1) an ID code assigned by anetwork of the specific friend of the subject and (2) a user-name of thespecific friend of the subject; and the second identificationinformation includes (1) an ID code assigned by a network of thespecific friend of the specific friend of the subject and (2) auser-name of the specific friend of the specific friend of the subject.6. The method of claim 4, wherein every empty cell in the spreadsheetfile is automatically filled in with a predetermined placeholder value.7. The method of claim 4, wherein the node file appends the secondidentification information with the first identification information andthe status identifier is a separate column in the spreadsheet file. 8.The method of claim 1, wherein the social network analysis metricsincludes one or more of betweenness closeness, eigenvector and degree.9. The method of claim 8, wherein the social network analysis metricsinclude a combined eigenvector and betweenness score to assess influenceand target priorities.
 10. The method of claim 1, wherein the accountsof interest are provided in a priority order.
 11. The method of claim 1,further comprising providing output that includes strategies to exploitthe accounts of interest.
 12. The method of claim 1, wherein the step ofdetermining friends of friends of the subject is achieved by one or moreweb crawlers.
 13. A method of automatically identifying lead andinfluencer accounts in an extended network of an online persona,comprising: determining friends of the online persona and friends of thefriends of the online persona; creating an edges list as a raw data fileincluding a plurality of separate entries as separate rows in aspreadsheet, each of the separate entries including a firstidentification information concerning a specific friend of the onlinepersona and a second identification information concerning a specificfriend of the specific friend of the online persona; creating separatefile, a nodes list, as a node file, the node file initially being aduplicate of the raw data file, with duplicate ones of the plurality ofseparate entries removed and a status identifier field added for eachresulting entry; establishing an op-update dictionary containing one ormore personas of interest; comparing each of the plurality of separateentries in the node file with data in the op-update dictionary to findmatching personas of interest from the op-update dictionary; creating apersona dictionary containing one or more controlled personas; comparingeach of the plurality of separate entries in the node file with data inthe persona dictionary to find matching controlled personas from thepersona dictionary; adding the matching personas of interest andmatching controlled personas into the status identifier field for theone of the plurality of separate entries in the node file; and applyingsocial network analysis metrics to the node file and the raw data fileto identify the lead and influencer accounts in the extended network.14. The method of claim 13, wherein: the first identificationinformation includes (1) an ID code assigned by a network of thespecific friend of the online persona and (2) a user-name of thespecific friend of the online persona; and the second identificationinformation includes (1) an ID code assigned by a network of thespecific friend of the specific friend of the online persona and (2) auser-name of the specific friend of the specific friend of the onlinepersona.
 15. The method of claim 13, wherein every empty cell in thespreadsheet is automatically filled in with a predetermined placeholdervalue.
 16. The method of claim 13, wherein the social network analysismetrics includes one or more of betweenness closeness, eigenvector,degree and a combined eigenvector and betweenness score to assessinfluence and target priorities.
 17. A non-transitory computer readablestorage medium tangibly embodying a computer readable program codehaving computer readable instructions that, when executed, causes acomputer device to carry out a method of automatically identifyingaccounts of interest in a virtual network, the method comprising:determining friends of a subject; determining friends of the friends ofthe subject; creating an edges list as a raw data file including aplurality of separate entries, each of the separate entries including afirst identification information concerning a specific friend of thesubject and a second identification information concerning a specificfriend of the specific friend of the subject; creating separate file, anodes list, as a node file, the node file initially being a duplicate ofthe raw data file, with duplicate ones of the plurality of separateentries removed and a status identifier field added for each resultingentry; establishing an op-update dictionary containing one or morepersonas of interest; comparing each of the plurality of separateentries in the node file with data in the op-update dictionary to findmatching personas of interest from the op-update dictionary; adding thematching personas of interest into the status identifier field for theone of the plurality of separate entries in the node file; and applyingsocial network analysis metrics to the node file and the raw data fileto identify the accounts of interest.
 18. The method of claim 17,further comprising: creating a persona dictionary containing one or morepersonas controlled by the subject; comparing each of the plurality ofseparate entries in the node file with data in the persona dictionary tofind matching controlled personas from the persona dictionary; addingthe matching controlled personas into the status identifier for the oneof the plurality of separate entries in the node file.
 19. The method ofclaim 17, wherein: the raw data file and node file are spreadsheet filesand each of the plurality of separate entries are rows in thespreadsheet files; and every empty cell in the spreadsheet file isautomatically filled in with a predetermined placeholder value.